All of lore.kernel.org
 help / color / mirror / Atom feed
From: ddaasd <ddaasd@gmail.com>
To: lartc@vger.kernel.org
Subject: [LARTC] iptables -m layer7 - doesn't work
Date: Tue, 02 Aug 2005 13:32:36 +0000	[thread overview]
Message-ID: <42EF75F4.5000109@gmail.com> (raw)

I've compiled my kernel (2.6.12.3) and iptables (1.3.3) and now -m
layer7 option from iptables works (i don't get any error when run the
iptables command with -m layer7).
The problem is that no packet is matched. For example iptables -A INPUT
-p tcp -m layer7 --l7proto http -j ACCEPT doesn't match http packets.
The same for dns and ssh.
So, what am I doing wrong? Is this extension for iptables really working??
I’ve tried on 2 systems (fc3 and slack 10.1)

Here is my iptables test script:
#!/bin/bash
iptables -F


iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp -m layer7 --l7dir /home/dda/l7dir
--l7proto http -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m layer7 --l7dir /home/dda/l7dir
--l7proto http -j ACCEPT


iptables -A INPUT -i eth0 -p udp -m layer7 --l7dir /home/dda/l7dir
--l7proto dns -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m layer7 --l7dir /home/dda/l7dir
--l7proto dns -j ACCEPT

iptables -P INPUT DROP
iptables -P OUTPUT DROP

and now: iptables -vnL after generating some http and dns traffic


Chain INPUT (policy DROP 56 packets, 8892 bytes)
pkts bytes target prot opt in out source destination
3340 134K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
129 9208 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto http
0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto dns

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3340 134K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
90 12254 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:22
0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto http
0 0 ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 LAYER7 l7proto dns

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

                 reply	other threads:[~2005-08-02 13:32 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=42EF75F4.5000109@gmail.com \
    --to=ddaasd@gmail.com \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.